CVE-2020-0669: LDAP Relay to SYSTEM in LSASS — No Server Attack Required

Attackers don't need to breach your LDAP server. They can stand up a fake one and wait for Windows machines to call home. One crafted LDAP response chains into SYSTEM-level code execution inside LSASS.EXE — no exploit binary, no malware, just protocol abuse.

We break down the relay, the Windows auto-enrollment trigger, detection blind spots, and what defenders can actually do about it.

⏱️ Timestamps
0:00 – Intro: Why this flips the script
1:30 – How LDAP relay works (plain English)
4:15 – The Windows auto-enrollment trigger
7:00 – Crafted response → LSASS execution
10:30 – Detection blind spots
12:45 – Mitigation and takeaways

🔗 Links
Spotify: https://open.spotify.com/episode/60ZrsnHVjH4Y1d3GOfstdb?si=PxD1P6t2QRCVR7n-TWHrkw
Microsoft advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-0669

#CVE20200669 #ldap #windowssecurity #LSASS #redteam #activedirectory #infosec #cybersecurity

Видео CVE-2020-0669: LDAP Relay to SYSTEM in LSASS — No Server Attack Required канала ZeroDay Brief